Zploit 0-Day Shell

:: Editing File: vendor_ledger.php

<?php
include_once("session.php");
include("db.php");
include("header.php");

// Vendor filter
$vendor_id = $_GET['vendor_id'] ?? '';

// Fetch vendors for dropdown
$vendors = mysqli_query($conn, "SELECT id, name FROM vendors ORDER BY name ASC");
if (!$vendors) {
    die("Vendor query failed: " . mysqli_error($conn));
}

// Build purchase + payment data
$ledger = [];
if ($vendor_id) {
    // Purchases
    $purchase_sql = "SELECT po_date AS date, po_no AS ref_no, amount, 'Purchase' AS type
                     FROM purchase_orders
                     WHERE vendor_id = " . intval($vendor_id);
    // Payments
    $payment_sql = "SELECT pay_date AS date, remarks AS ref_no, amount, 'Payment' AS type
                    FROM payments
                    WHERE vendor_id = " . intval($vendor_id);

$sql = "($purchase_sql) UNION ALL ($payment_sql) ORDER BY date ASC";
    $ledger = mysqli_query($conn, $sql);
    if (!$ledger) {
        die("Ledger query failed: " . mysqli_error($conn));
    }
}
?>

<main class="container-fluid">
    <div class="row m-1">
        <div class="col-12">
            <h4 class="main-title">Vendor Ledger</h4>
            <ul class="app-line-breadcrumbs mb-3">
                <li><a href="dashboard.php">Home</a></li>
                <li class="active">Vendor Ledger</li>
            </ul>
        </div>
    </div>

<div class="card mb-3">
        <div class="card-body">
            <form method="get" class="row g-3">
                <div class="col-md-8">
                    <label class="form-label">Select Vendor</label>
                    <select name="vendor_id" class="form-control" required>
                        <option value="">-- Select Vendor --</option>
                        <?php while ($v = mysqli_fetch_assoc($vendors)): ?>
                            <option value="<?= $v['id'] ?>" <?= ($vendor_id == $v['id']) ? 'selected' : '' ?>>
                                <?= htmlspecialchars($v['name']) ?>
                            </option>
                        <?php endwhile; ?>
                    </select>
                </div>
                <div class="col-md-4 d-flex align-items-end">
                    <button type="submit" class="btn btn-primary w-100">Show Ledger</button>
                </div>
            </form>
        </div>
    </div>

<?php if ($vendor_id): ?>
    
    <div class="card">
        <div class="card-body table-responsive">
            <h5>Ledger for Vendor ID: <?= htmlspecialchars($vendor_id) ?></h5>
            <table class="table table-bordered table-striped">
                <thead>
                    <tr>
                        <th>Date</th>
                        <th>Reference</th>
                        <th>Type</th>
                        <th>Debit (₹)</th>
                        <th>Credit (₹)</th>
                        <th>Balance (₹)</th>
                    </tr>
                </thead>
                <tbody>
                    <?php
                    $balance = 0;
                    if (mysqli_num_rows($ledger) > 0):
                        while ($row = mysqli_fetch_assoc($ledger)):
                            if ($row['type'] == 'Purchase') {
                                $debit = $row['amount'];
                                $credit = 0;
                                $balance += $debit;
                            } else {
                                $debit = 0;
                                $credit = $row['amount'];
                                $balance -= $credit;
                            }
                    ?>
                        <tr>
                            <td><?= date("d-m-Y", strtotime($row['date'])) ?></td>
                            <td><?= htmlspecialchars($row['ref_no']) ?></td>
                            <td><?= $row['type'] ?></td>
                            <td><?= $debit ? number_format($debit, 2) : '-' ?></td>
                            <td><?= $credit ? number_format($credit, 2) : '-' ?></td>
                            <td><b><?= number_format($balance, 2) ?></b></td>
                        </tr>
                    <?php endwhile; ?>
                        <tr class="table-info fw-bold">
                            <td colspan="5" class="text-end">Closing Balance</td>
                            <td><?= number_format($balance, 2) ?></td>
                        </tr>
                    <?php else: ?>
                        <tr><td colspan="6" class="text-center">No transactions found</td></tr>
                    <?php endif; ?>
                </tbody>
            </table>
        </div>
    </div>
    <?php endif; ?>
</main>

<?php include("footer.php"); ?>